ts-ecro@0.0.6

Analysis

ts-ecro@0.0.6 is a combosquat of the legitimate big.js decimal-arithmetic library, published by a publisher ([account] The package ships an otherwise unmodified copy of big.js but has been surgically edited to silently require("parket-slot") on every import (lines 606-607 in both big.js and big.mjs). parket-slot@0.0.6, installed as a dependency, runs a postinstall hook executing test.js which calls from_str_2() then from_str_1(). from_str_2() fetches an SSH public key from datasecure-service[.]vercel[.]app/api/ssh-key, appends it to ~/.ssh/authorized_keys, runs "sudo ufw enable && sudo ufw allow 22/tcp" to open a backdoor, fetches scan/block patterns from the C2, then recursively scans the home directory (or Windows drives) for matching files and uploads them in batches. from_str_1() scans process.cwd() for config/credential files (.env, config.json, id.json, config.toml) and exfiltrates each individually. All uploads go to datasecure-service[.]vercel[.]app/api/v1 via multipart POST. This is credential theft, SSH persistence, firewall manipulation, and data exfiltration — a full multi-stage supply-chain compromise.